summaryrefslogtreecommitdiff
path: root/net/sched
diff options
context:
space:
mode:
authorGao Feng <gfree.wind@vip.163.com>2017-06-28 12:53:54 +0800
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-07-21 07:44:54 +0200
commitc485792ed6491865037abc1e18bbd66240112c93 (patch)
tree1cf342388424095250fc0a5fbc22d6d60b6ddd67 /net/sched
parent0be4c96e7c57a5359e35eba32fd3559824f8c751 (diff)
net: sched: Fix one possible panic when no destroy callback
commit c1a4872ebfb83b1af7144f7b29ac8c4b344a12a8 upstream. When qdisc fail to init, qdisc_create would invoke the destroy callback to cleanup. But there is no check if the callback exists really. So it would cause the panic if there is no real destroy callback like the qdisc codel, fq, and so on. Take codel as an example following: When a malicious user constructs one invalid netlink msg, it would cause codel_init->codel_change->nla_parse_nested failed. Then kernel would invoke the destroy callback directly but qdisc codel doesn't define one. It causes one panic as a result. Now add one the check for destroy to avoid the possible panic. Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation") Signed-off-by: Gao Feng <gfree.wind@vip.163.com> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/sched')
-rw-r--r--net/sched/sch_api.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 35ed0d8c53b0..6d340cd6e2a7 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1005,7 +1005,8 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
return sch;
}
/* ops->init() failed, we call ->destroy() like qdisc_create_dflt() */
- ops->destroy(sch);
+ if (ops->destroy)
+ ops->destroy(sch);
err_out3:
dev_put(dev);
kfree((char *) sch - sch->padded);